Web & API
katana
Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.
What it is
katana crawls in-scope sites, including headless JS, and emits URLs, forms, and endpoints for later testing. It is a mapper, not an exploiter. Pair with httpx and a scope file so the crawl cannot wander onto SSO or payment processors.
Reach for it when
Web or API mapping when the sitemap is thin and you need a defensible list of routes before manual testing.
Watch-outs
Headless crawls execute application JavaScript — do not crawl authenticated production as a privileged user without RoE. Set depth, scope, and rate. Skip logout and destructive forms.
Typical invocation
katana -u https://portal.example -d 3 -jc -o recon/katana.txt
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.
- ffuf
Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.